Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '9b80e0c45ca7512ebc11ff5e40eb87ca' = '"%TEMP%\GoogleUpdate.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '9b80e0c45ca7512ebc11ff5e40eb87ca' = '"%TEMP%\GoogleUpdate.exe" ..'
- %APPDATA%\microsoft\windows\start menu\programs\startup\9b80e0c45ca7512ebc11ff5e40eb87ca.exe
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\GoogleUpdate.exe" "GoogleUpdate.exe" ENABLE
- %TEMP%\gcsgdw.exe
- %TEMP%\nxbfc.exe
- %TEMP%\is-s0j7g.tmp\gcsgdw.tmp
- %TEMP%\googleupdate.exe
- 'me#####s777.zapto.org':1177
- DNS ASK me#####s777.zapto.org
- '%TEMP%\gcsgdw.exe'
- '%TEMP%\nxbfc.exe'
- '%TEMP%\is-s0j7g.tmp\gcsgdw.tmp' /SL5="$B0228,24036448,830976,%TEMP%\Gcsgdw.exe"
- '%TEMP%\googleupdate.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\GoogleUpdate.exe" "GoogleUpdate.exe" ENABLE' (with hidden window)